Vulnerability Details CVE-2026-21712
A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called with a malformed internationalized domain name (IDN) containing invalid characters, crashing the Node.js process.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 24.5%
CVSS Severity
CVSS v3 Score 5.7
References
Products affected by CVE-2026-21712
-
cpe:2.3:a:nodejs:node.js:24.0.0
-
cpe:2.3:a:nodejs:node.js:24.0.1
-
cpe:2.3:a:nodejs:node.js:24.0.2
-
cpe:2.3:a:nodejs:node.js:24.1.0
-
cpe:2.3:a:nodejs:node.js:24.12.0
-
cpe:2.3:a:nodejs:node.js:24.13.0
-
cpe:2.3:a:nodejs:node.js:24.2.0
-
cpe:2.3:a:nodejs:node.js:24.3.0
-
cpe:2.3:a:nodejs:node.js:24.4.0
-
cpe:2.3:a:nodejs:node.js:24.4.1
-
cpe:2.3:a:nodejs:node.js:24.5.0
-
cpe:2.3:a:nodejs:node.js:25.0.0
-
cpe:2.3:a:nodejs:node.js:25.1.0
-
cpe:2.3:a:nodejs:node.js:25.2.0
-
cpe:2.3:a:nodejs:node.js:25.2.1
-
cpe:2.3:a:nodejs:node.js:25.3.0
-
cpe:2.3:a:nodejs:node.js:25.4.0
-
cpe:2.3:a:nodejs:node.js:25.5.0
-
cpe:2.3:a:nodejs:node.js:25.6.0
-
cpe:2.3:a:nodejs:node.js:25.6.1
-
cpe:2.3:a:nodejs:node.js:25.7.0
-
cpe:2.3:a:nodejs:node.js:25.8.0
-
cpe:2.3:a:nodejs:node.js:25.8.1